RISK-BASED CHANGE CONTROL - Risk Management Applications in Pharmaceutical and Biopharmaceutical Manufacturing - page 361

utilization for implementation of changes. This ensures that patient safety
is not adversely impacted because of the change.
• Risk assessment is typically used at two steps of the change control process
(Fig. 13.1). First, a defined, preapproved risk-based approach can be used
to perform initial risk assessment to determine whether they are in scope
or out of scope. Second, a more detailed risk assessment can be performed
for more complex changes, using formal tools such as failure modes and
effects analysis (FMEA) or process hazards analysis (PHA).
• Patient risk is difficult to measure directly, without a medical professional's
opinion. In the pharmaceutical industry, patient safety is also assured by
meeting both product quality and regulatory compliance requirements, which
are more easily measured. Therefore, product quality and regulatory com-
pliance may be considered as acceptable surrogates for patient safety.
• Critical success factors for integrating QRM into change control include
management commitment and support, a defined procedure for maintain-
ing risk management in a living process (or a living document), a cross-
functional change review team, and a process to ensure that any risk control
actions identified for the change are completed before production and/or
release of the product.
13.2 CHANGE CONTROL PROCESS
A formal change control process is a key component of a modern pharmaceutical
quality management system. Change control is required to assure that any changes
to established products, processes, or systems (such as equipment, facilities, util-
ities, materials, processes, or computers) are properly evaluated and implemented
to protect product quality and ultimately ensure patient safety. Figure 13.1 pro-
vides a flow chart of a typical change control process and shows where QRM
may be used.
QRM and knowledge management are two of the enablers used in imple-
menting modern quality systems [2]. Knowledge management can assure that
sound science and historical experience are used to evaluate changes. Regula-
tory agencies expect companies to know their products and to understand how
changes might affect product quality and patient safety. QRM provides a proac-
tive approach to identifying, evaluating, and controlling quality risks. Ideally,
risk management for each product or process includes a living, controlled risk
assessment document that serves as the standard against which all changes are
compared. Otherwise, the risk assessment document must be prepared on a case-
by-case basis.
The first step in a formal change control process is the initiation of the change.
This starts with a written change request. The change request should include a
description of the change, reason for change, justification for change, supporting
documentation (including existing risk assessments), and a proposed risk-based
implementation plan (including product quarantine requirements). The change